CVE-2026-10050 — Digest authentication lossy encoding

Affected: Eclipse Foundation Eclipse Jetty - EE8, Eclipse Foundation Eclipse Jetty - EE9, Eclipse Foundation Eclipse Jetty

In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes.

This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons.

If the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`.

An attacker can send a request with a digest `Authorization` header crafted with a password made of only `?` characters; the server would match any password of the same length that contains non-ISO-8859-1 characters.

Recent HTTP Digest [RFC-7616](https://datatracker.ietf.org/doc/html/rfc7616) supports a `charset` parameters that defaults to UTF-8 that allows for correct encoding/decoding of passwords.

GHSA-72hv-8253-57qq — jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition

Affected: Maven: tools.jackson.core:jackson-core, Maven: com.fasterxml.jackson.core:jackson-core

### Summary The non-blocking (async) JSON parser in `jackson-core` bypasses the `maxNumberLength` constraint (default: 1000 characters) defined in `StreamReadConstraints`. This allows an attacker to send JSON with arbitrarily long numbers through the async parser API, leading to excessive memory allocation and potential CPU exhaustion, resulting in a Denial of Service (DoS).

The standard synchronous parser correctly enforces this limit, but the async parser fails to do so, creating an inconsistent enforcement policy.

### Details The root cause is that the async parsing path in `NonBlockingUtf8JsonParserBase` (and related classes) does not call the methods responsible for number length validation.

- The number parsing methods (e.g., `_finishNumberIntegralPart`) accumulate digits into the `TextBuffer` without any length checks. - After parsing, they call `_valueComplete()`, which finalizes the token but does **not** call `resetInt()` or `resetFloat()`. - The `resetInt()`/`resetFloat()` methods in `ParserBase` are where the `validateIntegerLength()` and `validateFPLength()` checks are performed. - Because this validation step is skipped, the `maxNumberLength` constraint is never enforced in the async code path.

### PoC The following JUnit 5 test demonstrates the vulnerability. It shows that the async parser accepts a 5,000-digit number, whereas the limit should be 1,000.

```java package tools.jackson.core.unittest.dos;

import java.nio.charset.StandardCharsets;

import org…

Most recent entries from all

CVE-2026-10050 — Digest authentication lossy encoding

GHSA-72hv-8253-57qq — jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition